The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a suite of custom slash commands (/opsx:new, /opsx:apply, /opsx:verify, etc.) to interact with the Fission-AI CLI and manage the project lifecycle. While these are presented as internal tools, they represent the primary interface for system interaction.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could serve as an injection vector.
Ingestion points: The agent reads from openspec/specs/, openspec/changes/, tasks.md, and design.md to determine its actions.
Boundary markers: The instructions do not define specific delimiters or "ignore instructions" wrappers for the content read from these files.
Capability inventory: The skill (through its sub-skills) has the capability to write files, execute shell commands (via mcp-loop), and perform git operations.
Sanitization: There is no explicit evidence of sanitization or validation of the instructions contained within the read specification files.
[DYNAMIC_EXECUTION]: The workflow involves generating Flutter code (flutter-coding) and immediately building/executing it to verify functionality (mcp-loop). This automated generate-and-run cycle is a standard feature of the developer agent but remains a monitored behavior as it executes code constructed by the LLM.
[DATA_EXPOSURE]: The skill identifies the need for sensitive credentials (API keys for Firebase, Google Maps) but follows a safe practice by explicitly instructing the agent to stop and prompt the user rather than attempting to harvest or exfiltrate them.

project-orchestrator